diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-17 04:01:35 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-17 04:01:35 -0700 |
| commit | a562982612a97988ee112355225dc2ee31688011 (patch) | |
| tree | 62525805a97c3d487ea5159643ea60d979d2686d | |
| parent | d0a0e91ce5dfb77c1621ead800550723272e6772 (diff) | |
| parent | 9e50d6c84d5f7f6d15f59f45ae39d811b49535bd (diff) | |
Merge "msm: camera: isp: Handle array out of bound access" into dev/msm-4.4-8996au
| -rw-r--r-- | drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c index 373a963f75aa..a85ee30769c4 100644 --- a/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c +++ b/drivers/media/platform/msm/ais/isp/msm_isp_axi_util.c @@ -3889,6 +3889,12 @@ int msm_isp_update_axi_stream(struct vfe_device *vfe_dev, void *arg) case UPDATE_STREAM_REQUEST_FRAMES_VER2: { struct msm_vfe_axi_stream_cfg_update_info_req_frm *req_frm = &update_cmd->req_frm_ver2; + if (HANDLE_TO_IDX(req_frm->stream_handle) >= VFE_AXI_SRC_MAX) { + pr_err("%s: Invalid stream handle\n", __func__); + rc = -EINVAL; + break; + } + stream_info = &axi_data->stream_info[HANDLE_TO_IDX( req_frm->stream_handle)]; rc = msm_isp_request_frame(vfe_dev, stream_info, |